Aiutamici Forum
Benvenuto Ospite Cerca | Topic Attivi | Utenti | | Log In | Registra

Explorer 7.... infettato ? Opzioni
mef0454
Inviato: Tuesday, September 11, 2007 2:33:46 AM
Rank: Member

Iscritto dal : 9/11/2007
Posts: 0
Da qualche tempo quando eseguo una ricerca con yahoo o google mi viene regolarmente fornito l'elenco di tutti i link su quell'argomento, però allorchè clicco su uno di questi (per esempio Audi italia) anzichè essere collegato con tale sito mi viene proposto un sito del tutto diverso (es. Ebay, Maxfiles, Velvetic ecc.).
Ho provveduto a fare la scansione completa del sistema con Ad-ware e con AVG(antivirus)...ma l'inconveniente permane !
C' è qualche soluzione efficace ??
Grazie
Sponsor
Inviato: Tuesday, September 11, 2007 2:33:46 AM

 
a.roselli
Inviato: Tuesday, September 11, 2007 10:56:05 AM

Rank: Admin

Iscritto dal : 10/4/2000
Posts: 19,052
Scarica questo programma e leggi le istruzioni per inserire il log
http://www.aiutamici.com/software/descrizione.asp?CodSw=1175


alfonso_aiutamici@hotmail.it

mef0454
Inviato: Wednesday, September 12, 2007 3:17:24 PM
Rank: Member

Iscritto dal : 9/11/2007
Posts: 0
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15.14.52, on 12/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\msdtc.exe
C:\Programmi\File comuni\Acronis\Schedule2\schedul2.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WFXSVC.EXE
C:\Programmi\Symantec\WinFax\WFXMOD32.EXE
C:\WINDOWS\ehome\mcrdsvc.exe
C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Programmi\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Programmi\HP\QuickPlay\QPService.exe
C:\WINDOWS\system32\dllhost.exe
C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
C:\Programmi\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Programmi\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Programmi\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Programmi\File comuni\Acronis\Schedule2\schedhlp.exe
C:\WINDOWS\system32\wfxsnt40.exe
C:\Programmi\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\Ahead\InCD\InCD.exe
C:\Programmi\Java\jre1.6.0_02\bin\jusched.exe
C:\Programmi\Winamp\winampa.exe
C:\Programmi\SPAMfighter\SFAgent.exe
C:\Programmi\Yahoo!\Search Protection\SearchProtection.exe
C:\Programmi\Windows Defender\MSASCui.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Programmi\ClamWin\bin\ClamTray.exe
C:\Programmi\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Windows Media Player\WMPNSCFG.exe
C:\Programmi\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Programmi\Symantec\WinFax\WFXCTL32.EXE
C:\Programmi\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Programmi\Google\Google Updater\GoogleUpdater.exe
C:\Programmi\Hewlett-Packard\HP Pavilion Webcam\HPWebcam.exe
C:\Programmi\HP\Digital Imaging\bin\hpqimzone.exe
C:\Programmi\WinZip\WZQKPICK.EXE
C:\PROGRA~1\Grisoft\AVG7\avgw.exe
C:\Programmi\Microsoft Office\Office\1040\msoffice.exe
C:\Programmi\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\WINDOWS\system32\mioengine.exe
C:\Programmi\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\Outlook Express\msimn.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\VLPGNR\Impostazioni locali\Temp\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://it.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://it.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://it.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3andtp=iehomeandlocale=IT_ITandc=64andbd=pavilion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Programmi\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: TBSB00160 - {B629A5B8-6C0D-4BC3-86AA-F9A289719E9F} - C:\PROGRA~1\PAGINE~1\visual.dll (file missing)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programmi\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: PagineGialle Visual Toolbar - {382BE5E1-D321-42ED-8820-CBAF85280AFB} - C:\Programmi\PagineGialle Visual Toolbar\visual.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Programmi\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QlbCtrl] :ProgramFiles:\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Programmi\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Programmi\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Programmi\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Programmi\File comuni\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programmi\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Programmi\File comuni\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Programmi\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Programmi\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Programmi\Winamp\winampa.exe
O4 - HKLM\..\Run: [KernelFaultCheck] :systemroot:\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SPAMfighter Agent] "C:\Programmi\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKLM\..\Run: [PCTAVApp] "C:\Programmi\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [YSearchProtection] "C:\Programmi\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Programmi\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ClamWin] "C:\Programmi\ClamWin\bin\ClamTray.exe" --logon
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programmi\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8
O4 - HKCU\..\Run: [NBJ] "C:\Programmi\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [YSearchProtection] C:\Programmi\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Programmi\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [PCTAVApp] "C:\Programmi\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: My Vodafone.it.lnk = C:\Documents and Settings\VLPGNR\Application Data\mioObjects\[objects]\69GWEU9386MTAR08.mio
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programmi\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Avvio rapido HP Photosmart Premier.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Controller.LNK = C:\Programmi\Symantec\WinFax\WFXCTL32.EXE
O4 - Global Startup: Google Updater.lnk = C:\Programmi\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: HP Pavilion Webcam Tray Icon.lnk = C:\Programmi\Hewlett-Packard\HP Pavilion Webcam\HPWebcam.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Aggiungi all'elenco di stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Anteprima Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Stampa ad alta velocità Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Stampa Easy-WebPrint - res://C:\Programmi\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O10 - Unknown file in Winsock LSP: c:\programmi\hide my ip 2007\proxyfilter.dll
O12 - Plugin for .spop: C:\Programmi\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=IT_IT&c=64&bd=pavilion&pf=laptop
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1165587136062
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1187247799218
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{00943A25-B70E-4A5C-8A0A-0759DA2692ED}: NameServer = 85.255.116.135,85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{293A39A0-06D2-4AE7-B295-B47EB36C4A56}: NameServer = 85.255.116.135,85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{83A91502-366F-4A0D-B5F8-F2F874B58031}: NameServer = 85.255.116.135,85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{9408B169-24DA-46E8-9540-FA21342B6DE1}: NameServer = 85.255.116.135,85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{A29DC70B-B98E-491E-9292-7D421BF3EE5E}: NameServer = 85.255.116.135,85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{BD1CB8B0-0801-435D-ADF3-7BF17449DA34}: NameServer = 85.255.116.135,85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{DC5DED38-8F9A-4C98-8CAA-D988B270DBB9}: NameServer = 85.255.116.135,85.255.112.65
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.135 85.255.112.65
O17 - HKLM\System\CS2\Services\Tcpip\..\{00943A25-B70E-4A5C-8A0A-0759DA2692ED}: NameServer = 85.255.116.135,85.255.112.65
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.116.135 85.255.112.65
O17 - HKLM\System\CS3\Services\Tcpip\..\{00943A25-B70E-4A5C-8A0A-0759DA2692ED}: NameServer = 85.255.116.135,85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.135 85.255.112.65
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programmi\File comuni\Acronis\Schedule2\schedul2.exe
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programmi\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Programmi\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Programmi\Ahead\InCD\InCDsrv.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - Unknown owner - C:\Programmi\PC Tools AntiVirus\PCTAVSvc.exe (file missing)
O23 - Service: Utilità di pianificazione di LiveUpdate automatico - Symantec Corporation - C:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - C:\WINDOWS\system32\WFXSVC.EXE

--
End of file - 19295 bytes
a.roselli
Inviato: Wednesday, September 12, 2007 4:57:54 PM

Rank: Admin

Iscritto dal : 10/4/2000
Posts: 19,052
Ciao,
esegui queste operazioni

ATTENZIONE prima di procedere con le riparazioni, fate la copia di riserva dei vostri dati,
leggete questo articolo http://www.aiutamici.com/hardware/view.asp?codcat=8
a volte eliminando un virus il sistema potrebbe non riavviarsi.
____________________________

Disattiva il ripristino di configurazione, leggi qui come fare
http://www.aiutamici.com/hardware/view.asp?codcat=28

Riavvia in modalità provvisoria, leggi qui come fare
http://www.aiutamici.com/hardware/view.asp?codcat=29

apri HIJAC THIS ed elimina come indicato in questo articolo
http://www.aiutamici.com/software/descrizione.asp?CodSw=1175
le righe che seguono.

==================================
O2 - BHO: TBSB00160 - {B629A5B8-6C0D-4BC3-86AA-F9A289719E9F} - C:\PROGRA~1\PAGINE~1\visual.dll (file missing)
-
O3 - Toolbar: PagineGialle Visual Toolbar - {382BE5E1-D321-42ED-8820-CBAF85280AFB} - C:\Programmi\PagineGialle Visual Toolbar\visual.dll (file missing)
-
O17 - HKLM\System\CCS\Services\Tcpip\..\{00943A25-B70E-4A5C-8A0A-0759DA2692ED}: NameServer = 85.255.116.135,85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{293A39A0-06D2-4AE7-B295-B47EB36C4A56}: NameServer = 85.255.116.135,85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{83A91502-366F-4A0D-B5F8-F2F874B58031}: NameServer = 85.255.116.135,85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{9408B169-24DA-46E8-9540-FA21342B6DE1}: NameServer = 85.255.116.135,85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{A29DC70B-B98E-491E-9292-7D421BF3EE5E}: NameServer = 85.255.116.135,85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{BD1CB8B0-0801-435D-ADF3-7BF17449DA34}: NameServer = 85.255.116.135,85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{DC5DED38-8F9A-4C98-8CAA-D988B270DBB9}: NameServer = 85.255.116.135,85.255.112.65
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.135 85.255.112.65
O17 - HKLM\System\CS2\Services\Tcpip\..\{00943A25-B70E-4A5C-8A0A-0759DA2692ED}: NameServer = 85.255.116.135,85.255.112.65
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.116.135 85.255.112.65
O17 - HKLM\System\CS3\Services\Tcpip\..\{00943A25-B70E-4A5C-8A0A-0759DA2692ED}: NameServer = 85.255.116.135,85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.135 85.255.112.65
==================================


Elimina i file inutili del sistema utilizzando questo programma
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=1223

Utilizza questi due programmi per eliminare eventuali spyware
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=878
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=831

sempre in modalità provvisoria fai una scansione Antivirus,
se non hai un antivirus, utilizza questo programma
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=1485

quindi riavvia il computer e controlla se il problema e risolto, se e tutto OK riattiva il ripristino configurazione disattivato all'inizio di questa procedura e crea un nuovo punto di ripristino, leggi qui alla voce 8
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=170&SH=N
in caso di problemi lascialo disattivato fino alla soluzione dei problemi

Fai una scansione antivirus on line da questo indirizzo
http://security.symantec.com/sscv6/default.asp?productid=globalsites&langid=it&venid=sym
se la scansione on line rileva dei virus significa che il tuo antivirus è stato infettato o non è in grado di risolvere il problema, ti consiglio di formattare il disco fisso e reinstallare tutto, altrimenti prosegui

Nel sistema non é presente un Firewall, installa questo programma se non ne utilizzi già uno
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=56
e disattiva l'inutile firewall di XP, leggi qui
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=160&SH=N

Utilizza questo programma
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=1041

Se utilizzi XP ti consiglio di installare questo programma
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=1472

alfonso_aiutamici@hotmail.it

Utenti presenti in questo topic
Guest


Salta al Forum
Aggiunta nuovi Topic disabilitata in questo forum.
Risposte disabilitate in questo forum.
Eliminazione tuoi Post disabilitata in questo forum.
Modifica dei tuoi post disabilitata in questo forum.
Creazione Sondaggi disabilitata in questo forum.
Voto ai sondaggi disabilitato in questo forum.

Main Forum RSS : RSS

Aiutamici Theme
Powered by Yet Another Forum.net versione 1.9.1.8 (NET v2.0) - 3/29/2008
Copyright © 2003-2008 Yet Another Forum.net. All rights reserved.